OffSec SOC-200 (OSDA) – Online 90 days

All prerequisites for SOC-200 can be found within the OffSec Fundamentals Program, included with a Learn subscription.

Prerequisite Topics include:

• SOC-100: prerequisites for SOC-200

• Learn how attackers operate with the MITRE ATT&CK® framework

• Audit Windows and Linux endpoints

• Review common attacks

• Use a SIEM to track adversaries

Students who complete the course and pass the associated exam earn the Offensive Security Defence Analyst (OSDA) certification, demonstrating their ability to detect and assess security incidents.

ABOUT THE EXAM

• The OSDA exam cannot be scheduled at this time

• The SOC-200 course prepares you for the OSDA certification

Introduction to SOC-200

a. Secrets of Success with SOC-200

• Understand Offense to Improve Defence

• A Mindset of Learning

• Collect Data and Do Your Research

b. Getting Started With SOC-200

• The Course Structure

• Lab Overview Connecting to the VPN

• Disconnecting from the VPN

• Conclusion

Attacker Methodology Introduction

a. The Network as a Whole

• The DMZ

• Deployment Environments

• Core and Edge Network Devices

• Virtual Private Networks and Remote Sites

b. The Lockheed-Martin Cyber Kill-Chain

• The Importance of the Kill-Chain

• Case Study 1: Monero Cryptomining

• Case Study 2: Petya, Mischa, and GoldenEye

c. MITRE ATT&CK Framework

• Tactics, Techniques, and Sub-Techniques

• Case Study 1: OilRig

• Case Study 2: APT3

• Case Study 3: APT28

d. Wrapping Up

Windows Endpoint Introduction

a. Windows Processes

b. Windows Registry

c. Command Prompt, VBScript, and Powershell

• Command Prompt

• Visual Basic Script (VBScript)

• PowerShell

d. Programming on Windows

• Component Object Model

• .NET and .NET Core

e. Windows Event Log

• Introduction to Windows Events

• PowerShell and Event Logs

f. Empowering the Logs

• System Monitor (Sysmon)

• Sysmon and Event Viewer

• Sysmon and PowerShell

• Remote Access with PowerShell Core

g. Wrapping Up

Windows Server Side Attacks

a. Credential Abuse

• The Security Account Manager (SAM) and Windows Authentication

• Suspicious Logins

• Brute Force Logins

b. Web Application Attacks

• Internet Information Services (IIS)

• Local File Inclusion

• Command Injection

• File Upload

c. Binary Exploitation

• Binary Attacks

• Windows Defender

• Exploit Guard (WDEG)

d. Wrapping Up

Windows Client-Side Attacks

a. Attacking Microsoft Office

• Social Engineering and Spearphishing

• Installing Microsoft Office

• Using Macros

b. Monitoring Windows PowerShell

• Introduction to PowerShell Logging

• PowerShell Module Logging

• PowerShell Script Block Logging

• PowerShell Transcription

• Case Study: PowerShell Logging for Phishing Attacks

• Obfuscating/Deobfuscating Commands

c. Wrapping Up

Windows Privilege Escalation

a. Privilege Escalation Introduction

• Privilege Escalation

• Enumeration

• User Account Control

• Bypassing UAC

b. Escalating to SYSTEM

• Service Creation

• Attacking Service Permissions

• Leveraging Unquoted Service Paths

c. Wrapping Up

Linux Endpoint Introduction

a. Linux Applications and Daemons

• Daemons

• Logging on Linux and the Syslog Framework

• Rsyslog Meets Journal

• Web Daemon Logging

b. Automating the Defensive Analysis

• Python for Log Analysis

• DevOps Tools

• Hunting for Login Attempts

d. Wrapping Up

Linux Server Side Attacks

a. Credential Abuse

• Suspicious Logins

• Password Brute Forcing

b. Web Application Attacks

• Command Injection

• SQL Injection

c. Wrapping Up

Linux Privilege Escalation

a. Attacking the Users

• Becoming a User

• Backdooring a User

b. Attacking the System

• Abusing System Programs

• Weak Permissions

c. Wrapping Up